User access to computer networks has traditionally been based upon a two step authentication process that either provides a user total network access, or refuses the user any access whatsoever. In the first step of the process, a user establishes a communication link with a network via a telephone line, dedicated network connection (e.g., Broadband, Digital Signal Line (DSL)), or the like. In the second step of the authentication process, the user must input identification information to gain access to the network. Typically, the input identification information includes a user name and password. Using this information, the network or service provider verifies that the user is entitled to access the network by determining whether the identification information matches subscriber information contained in a subscriber table (or database) that stores identification information for all users authorized to access the network. Where user input information matches subscriber data in the subscriber table, the user is authorized to access any and all services on the network. On the other hand, if the user input identification information fails to match subscriber data in the table, the user will be denied access to the network. Thus, once a user's identity is compared to data stored within a subscription table, the user is either entitled network access, or denied access altogether. Furthermore, where the user is authorized access to the network, the user is typically authorized to access any destination accessible via the network. Therefore, conventional authentication of users is based on an all-or-nothing approach to network access.
In many conventional network access applications, such as in conventional Internet access applications, the subscriber database (or table) not only stores data corresponding to the identity of subscribers authorized to access the network, but also stores information that can vary based upon the particular subscriber. For instance, the subscriber database can include subscriber profiles that indicate the type of access a subscriber should receive, and other related information, such as the fees due by the subscriber for network access. Although information in the subscriber database may vary from user to user, information unique to the database is generally used for billing or network maintenance purposes. For instance, conventional subscriber databases typically include data such as the cost the subscriber is paying for network access, and the amount of time the subscriber has accessed the network. Thus, where a subscriber to an Internet Service Provider (ISP) has purchased Internet access, a source profile database may contain information that enables a user to be authenticated and tracks the user's access for accounting purposes, such as maintaining a log of the user's time on the network.
Additionally, in conventional network access systems, in order for a user to connect to on-line services (e.g., the Internet), the user must install client side software onto the user's computer. Client side software is typically provided by a network administrator or network access provider, such as an ISP with whom the user has subscribed for Internet access, and enables the client to configure his or her computer to communicate with that network access provider. Continuing with the illustrative example of a user accessing the Internet via an ISP, the user must install ISP software on the client computer, and thereafter establish an account with the ISP for Internet access. Typically, a user subscribes to an ISP, such as America Online™, Earthlink™, Compuserve™ or the like, by contracting directly with the ISP for Internet access. Usually, the user pays for such Internet access on a monthly fixed fee basis. Regardless of the user's location, the user may dial up an access number provided by the ISP and obtain Internet access. The connection is often achieved via a conventional telephone modem, cable modem, DSL connection, or the like.
Because users accessing networks through conventional methods, such as through ISPs, are either allowed or denied access to a network in an all or nothing approach, users cannot be dynamically authorized access to a network such that the user's access and authorization to particular networks or sites is customizable. What is needed is a method and system that allows users dynamic and customizable access that may vary based upon any number of variables associated with a user, such as a user location, user name or password, user computer, or other attributes. For example, it would be advantageous for some users to be authorized access to all Internet sites, while others may be denied access to particular sites. In addition to authorizing user access to a network, it would be advantageous for a network, such as an ISP or enterprise network, to selectively permit users a range of authorization, such that the user's access is not based upon an all or nothing approach.